agentic-qe 3.14.4 → 3.14.6

package/dist/cli/commands/audit.d.ts

@@ -4,7 +4,8 @@
  * Verifies the witness chain audit trail integrity.
  * Shows chain length, integrity status, and last receipt hash.
  *
- * Usage: aqe audit verify [--format json|text]
+ * Usage: aqe audit verify [--chain governance|audit] [--format json|text]
+ *        aqe audit repair --chain audit [--dry-run] [--format json|text]
  *
  * @module cli/commands/audit
  * @see ADR-083-coherence-gated-agent-actions.md
@@ -12,6 +13,8 @@
 import { Command } from 'commander';
 import { type ChainVerificationResult } from '../../governance/witness-chain.js';
 import type { CLIContext } from '../handlers/interfaces.js';
+import type { ChainStatus } from '../../audit/witness-chain-verifier.js';
+import type { RepairResult } from '../../audit/witness-chain-repair.js';
 /**
  * Verification output for JSON format.
  */
@@ -22,11 +25,17 @@ export interface AuditVerifyOutput {
     brokenAt: number;
     lastHash: string;
     message: string;
+    status?: ChainStatus;
+    tampered?: boolean;
+    tamperedAt?: number;
+    tamperReason?: string;
+    forks?: number[];
+    acknowledgedForks?: number[];
 }
 /**
  * Format verification result as human-readable text.
  */
-export declare function formatVerificationText(result: ChainVerificationResult, featureEnabled: boolean): string;
+export declare function formatVerificationText(result: ChainVerificationResult, featureEnabled: boolean, audit?: Pick<AuditVerifyOutput, 'status' | 'tamperedAt' | 'tamperReason' | 'forks' | 'acknowledgedForks'>): string;
 /**
  * Handle the audit verify command.
  *
@@ -48,6 +57,15 @@ export declare function handleAuditVerify(options: {
 export declare function handleAuditChainVerify(options: {
     format?: 'json' | 'text';
 }): Promise<AuditVerifyOutput>;
+/**
+ * `aqe audit repair --chain audit`: re-anchor a store whose only breaks are
+ * accidental pre-3.14.5 forks (#753). Refuses on tampering, backs up first,
+ * never rewrites existing rows. See src/audit/witness-chain-repair.ts.
+ */
+export declare function handleAuditChainRepair(options: {
+    format?: 'json' | 'text';
+    dryRun?: boolean;
+}): Promise<RepairResult>;
 /**
  * Create the audit command group following the project convention.
  */

package/dist/cli/commands/audit.js

@@ -4,7 +4,8 @@
  * Verifies the witness chain audit trail integrity.
  * Shows chain length, integrity status, and last receipt hash.
  *
- * Usage: aqe audit verify [--format json|text]
+ * Usage: aqe audit verify [--chain governance|audit] [--format json|text]
+ *        aqe audit repair --chain audit [--dry-run] [--format json|text]
  *
  * @module cli/commands/audit
  * @see ADR-083-coherence-gated-agent-actions.md
@@ -18,7 +19,7 @@ import path from 'node:path';
 /**
  * Format verification result as human-readable text.
  */
-export function formatVerificationText(result, featureEnabled) {
+export function formatVerificationText(result, featureEnabled, audit) {
     const lines = [];
     lines.push(chalk.bold('Witness Chain Audit Verification'));
     lines.push('');
@@ -30,20 +31,36 @@ export function formatVerificationText(result, featureEnabled) {
     // Chain length
     lines.push(`  Chain Length:  ${result.length} receipts`);
     // Integrity status
-    const integrityStatus = result.valid
-        ? chalk.green('VALID')
-        : chalk.red('BROKEN');
+    const integrityStatus = audit?.status === 'forked'
+        ? chalk.yellow('FORKED (no tampering detected)')
+        : result.valid
+            ? chalk.green(audit?.status === 'valid-with-forks' ? 'VALID (forks re-anchored)' : 'VALID')
+            : chalk.red(audit?.status === 'tampered' ? 'BROKEN (tampering detected)' : 'BROKEN');
     lines.push(`  Integrity:    ${integrityStatus}`);
     // Last hash
     if (result.length > 0) {
         lines.push(`  Last Hash:    ${result.lastHash.slice(0, 16)}...`);
     }
+    const forkCount = audit?.forks?.length ?? 0;
+    if (forkCount > 0) {
+        const reanchored = audit?.acknowledgedForks?.length ?? 0;
+        lines.push(`  Forks:        ${forkCount} accidental (pre-3.14.5 concurrent writes, #753), ${reanchored} re-anchored`);
+    }
     // Details
-    if (!result.valid && result.brokenAt >= 0) {
+    if (audit?.status === 'forked') {
+        lines.push('');
+        lines.push(chalk.yellow(`  ${result.message}`));
+    }
+    else if (!result.valid && result.brokenAt >= 0) {
         lines.push('');
-        lines.push(chalk.red(`  Break detected at index ${result.brokenAt}`));
+        const at = audit?.status === 'tampered' && audit.tamperedAt !== undefined ? audit.tamperedAt : result.brokenAt;
+        lines.push(chalk.red(`  Break detected at index ${at}${audit?.tamperReason ? ` (${audit.tamperReason})` : ''}`));
         lines.push(chalk.red(`  ${result.message}`));
     }
+    else if (result.valid && forkCount > 0) {
+        lines.push('');
+        lines.push(chalk.green(`  ${result.message}`));
+    }
     lines.push('');
     return lines.join('\n');
 }
@@ -109,8 +126,7 @@ export async function handleAuditVerify(options) {
  */
 export async function handleAuditChainVerify(options) {
     const { WitnessChain, hashWith, serializeEntry } = await import('../../audit/witness-chain.js');
-    const root = findProjectRoot();
-    const dbPath = path.join(root, '.agentic-qe', 'memory.db');
+    const { dbPath, keyDir } = auditChainPaths();
     let output;
     if (!existsSync(dbPath)) {
         output = {
@@ -126,10 +142,15 @@ export async function handleAuditChainVerify(options) {
         const { default: Database } = await import('better-sqlite3');
         const db = new Database(dbPath, { readonly: true });
         try {
-            const chain = new WitnessChain(db);
+            const chain = new WitnessChain(db, (await loadReadOnlyKeyManager(keyDir)) ?? undefined);
             await chain.initialize();
-            const result = chain.verify({ includeArchive: true, checkSignatures: true });
-            const lastEntry = db.prepare('SELECT * FROM witness_chain ORDER BY id DESC LIMIT 1').get();
+            // Fork and CHAIN_REANCHOR rows signed by a key in witness-keys/ are always
+            // signature-checked. The every-row `checkSignatures` sweep stays off, as it
+            // effectively was before this command loaded keys: it would fail rows
+            // signed by keys this project never stored (e.g. imported rows).
+            const result = chain.verify({ includeArchive: true, checkSignatures: false });
+            const { tableExists } = await import('../../audit/witness-chain-verifier.js');
+            const lastEntry = !tableExists(db, 'witness_chain') ? undefined : db.prepare('SELECT * FROM witness_chain ORDER BY id DESC LIMIT 1').get();
             const lastHash = lastEntry
                 ? hashWith(lastEntry.hash_algo || 'sha256', serializeEntry(lastEntry))
                 : '';
@@ -139,9 +160,13 @@ export async function handleAuditChainVerify(options) {
                 integrity: result.valid,
                 brokenAt: result.brokenAt ?? -1,
                 lastHash,
-                message: result.valid
-                    ? `Audit chain verified: ${result.entriesChecked} entries checked, ${result.signatureFailures ?? 0} signature failures`
-                    : `Audit chain BROKEN at id=${result.brokenAt} (${result.entriesChecked} entries checked before the break)`,
+                message: auditChainMessage(result),
+                status: result.status,
+                tampered: result.tampered,
+                ...(result.tamperedAt !== undefined ? { tamperedAt: result.tamperedAt } : {}),
+                ...(result.tamperReason ? { tamperReason: result.tamperReason } : {}),
+                forks: result.forks,
+                acknowledgedForks: result.acknowledgedForks,
             };
         }
         finally {
@@ -152,10 +177,103 @@ export async function handleAuditChainVerify(options) {
         console.log(JSON.stringify(output, null, 2));
     }
     else {
-        console.log(formatVerificationText({ valid: output.integrity, length: output.chainLength, brokenAt: output.brokenAt, lastHash: output.lastHash, message: output.message }, output.featureEnabled));
+        console.log(formatVerificationText({ valid: output.integrity, length: output.chainLength, brokenAt: output.brokenAt, lastHash: output.lastHash, message: output.message }, output.featureEnabled, output));
     }
     return output;
 }
+function auditChainPaths() {
+    const root = findProjectRoot();
+    return {
+        dbPath: path.join(root, '.agentic-qe', 'memory.db'),
+        keyDir: path.join(root, '.agentic-qe', 'witness-keys'),
+    };
+}
+/** Persisted witness keys, loaded without generating (or writing) anything. */
+async function loadReadOnlyKeyManager(keyDir) {
+    if (!existsSync(keyDir))
+        return null;
+    const { WitnessKeyManager: KeyManager } = await import('../../audit/witness-key-manager.js');
+    return new KeyManager({ keyDir, autoGenerate: false });
+}
+function auditChainMessage(result) {
+    const n = result.entriesChecked;
+    const forks = result.forks.length;
+    const pending = forks - result.acknowledgedForks.length;
+    switch (result.status) {
+        case 'valid':
+            return `Audit chain verified: ${n} entries checked, ${result.signatureFailures ?? 0} signature failures`;
+        case 'valid-with-forks':
+            return `Audit chain verified: ${n} entries checked; ${forks} accidental fork(s) from pre-3.14.5 ` +
+                'concurrent writes are re-anchored by CHAIN_REANCHOR, no tampering detected';
+        case 'forked':
+            return `${pending} accidental fork(s) (pre-3.14.5 concurrent writes, #753), no tampering detected — ` +
+                `${n} entries checked, first fork at id=${result.brokenAt}. ` +
+                'Run `aqe audit repair --chain audit` to back up the store and re-anchor.';
+        default:
+            return `Audit chain BROKEN: tampering detected at id=${result.tamperedAt} (${result.tamperReason}); ` +
+                `${n} entries checked` + (forks > 0 ? `, ${forks} accidental fork(s) found before it` : '');
+    }
+}
+function repairFailed(result) {
+    if (result.action === 'refused')
+        return true;
+    return result.action === 'reanchored' && !(result.after?.status === 'valid' || result.after?.status === 'valid-with-forks');
+}
+/**
+ * `aqe audit repair --chain audit`: re-anchor a store whose only breaks are
+ * accidental pre-3.14.5 forks (#753). Refuses on tampering, backs up first,
+ * never rewrites existing rows. See src/audit/witness-chain-repair.ts.
+ */
+export async function handleAuditChainRepair(options) {
+    const { repairWitnessChainForks } = await import('../../audit/witness-chain-repair.js');
+    const { dbPath, keyDir } = auditChainPaths();
+    const dryRun = options.dryRun === true;
+    let result;
+    if (!existsSync(dbPath)) {
+        const empty = { status: 'valid', entriesChecked: 0, forks: 0, unacknowledgedForks: 0 };
+        result = {
+            action: 'none', dryRun, message: `No database found at ${dbPath} — nothing to repair`,
+            before: empty, rowsBefore: { live: 0, archive: 0 }, rowsAfter: { live: 0, archive: 0 }, forksAcknowledged: [],
+        };
+    }
+    else {
+        const { openDatabase } = await import('../../shared/safe-db.js');
+        // A dry run opens read-only and never generates a signing key.
+        const db = openDatabase(dbPath, { readonly: dryRun, fileMustExist: true });
+        try {
+            const keyManager = dryRun
+                ? await loadReadOnlyKeyManager(keyDir)
+                : (await import('../../audit/witness-key-manager.js')).getDefaultWitnessKeyManager();
+            result = await repairWitnessChainForks(db, { dbPath, dryRun, keyManager });
+        }
+        finally {
+            db.close();
+        }
+    }
+    if (options.format === 'json') {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else {
+        console.log(formatRepairText(result));
+    }
+    return result;
+}
+function formatRepairText(result) {
+    const color = result.action === 'refused' ? chalk.red : result.action === 'reanchored' ? chalk.green : chalk.yellow;
+    const lines = [
+        chalk.bold('Witness Chain Audit Repair'),
+        '',
+        `  Action:       ${color(result.action.toUpperCase())}${result.dryRun ? ' (dry run)' : ''}`,
+        `  Before:       ${result.before.status}, ${result.before.forks} fork(s), ${result.before.unacknowledgedForks} unacknowledged`,
+        `  Rows:         live ${result.rowsBefore.live} -> ${result.rowsAfter.live}, archive ${result.rowsBefore.archive} -> ${result.rowsAfter.archive}`,
+    ];
+    if (result.after)
+        lines.push(`  After:        ${result.after.status}`);
+    if (result.backupPath)
+        lines.push(`  Backup:       ${result.backupPath}`);
+    lines.push('', `  ${color(result.message)}`, '');
+    return lines.join('\n');
+}
 /**
  * Create the audit command group following the project convention.
  */
@@ -180,6 +298,30 @@ export function createAuditCommand(_context, cleanupAndExit, _ensureInitialized)
             await cleanupAndExit(1);
         }
     });
+    audit
+        .command('repair')
+        .description('Re-anchor accidental pre-3.14.5 forks in the audit chain (#753); backs up first, refuses on tampering')
+        .option('-C, --chain <chain>', 'Chain to repair (only "audit" is supported)', 'audit')
+        .option('--dry-run', 'Report what would be done without writing anything', false)
+        .option('-F, --format <format>', 'Output format (json|text)', 'text')
+        .action(async (options) => {
+        try {
+            if (options.chain !== 'audit') {
+                console.error(`aqe audit repair supports only --chain audit (got "${options.chain}")`);
+                await cleanupAndExit(1);
+                return;
+            }
+            const result = await handleAuditChainRepair({
+                format: options.format,
+                dryRun: options.dryRun === true,
+            });
+            await cleanupAndExit(repairFailed(result) ? 1 : 0);
+        }
+        catch (error) {
+            console.error('Failed to repair witness chain:', error);
+            await cleanupAndExit(1);
+        }
+    });
     return audit;
 }
 //# sourceMappingURL=audit.js.map

package/dist/cli/commands/claude-flow-setup.js

@@ -16,7 +16,8 @@
  * - Rule-based model routing
  * - Local pattern learning
  */
-import { existsSync, writeFileSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
+import { writeFileIfChanged } from '../../init/idempotent-write.js';
 import { join } from 'node:path';
 import { safeJsonParse } from '../../shared/safe-json.js';
 import { toErrorMessage } from '../../shared/error-utils.js';
@@ -143,8 +144,8 @@ function updateMCPConfig(projectRoot) {
             env: {},
         };
     }
-    // Write updated settings
-    writeFileSync(claudeSettingsPath, JSON.stringify(settings, null, 2));
+    // Write updated settings — only when something changed (#778).
+    writeFileIfChanged(claudeSettingsPath, JSON.stringify(settings, null, 2));
 }
 // ============================================================================
 // Main Setup Function
@@ -195,7 +196,7 @@ export async function setupClaudeFlowIntegration(options) {
     const configPath = join(aqeDir, 'claude-flow-integration.json');
     try {
         const config = generateClaudeFlowConfig(projectRoot, features);
-        writeFileSync(configPath, JSON.stringify(config, null, 2));
+        writeFileIfChanged(configPath, JSON.stringify(config, null, 2));
         if (debug)
             console.log(`[ClaudeFlow] Config written to: ${configPath}`);
     }

package/dist/cli/commands/mcp.js

@@ -13,6 +13,8 @@ import { join, dirname } from 'path';
 import { existsSync } from 'fs';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { findPackageRoot } from '../../init/find-package-root.js';
+import { resolveCliLogLevel, setCliLogLevel } from '../log-gate.js';
+import { LogLevel } from '../../logging/index.js';
 /**
  * Create the MCP command
  */
@@ -28,6 +30,10 @@ export function createMcpCommand() {
         if (options.verbose) {
             process.env.AQE_VERBOSE = 'true';
         }
+        // The server runs in this process under the CLI log gate. Keep its
+        // historical INFO default (diagnostics go to stderr, never the stdio
+        // protocol stream) unless AQE_LOG_LEVEL / LOG_LEVEL say otherwise.
+        setCliLogLevel(resolveCliLogLevel(process.env, LogLevel.INFO));
         // Find the MCP entry point
         const entryPath = findMcpEntry();
         if (!entryPath) {

package/dist/cli/commands/memory.d.ts

@@ -7,5 +7,5 @@
  */
 import { Command } from 'commander';
 import type { CLIContext } from '../handlers/interfaces.js';
-export declare function createMemoryCommand(context: CLIContext, cleanupAndExit: (code: number) => Promise<never>, ensureInitialized: () => Promise<boolean>): Command;
+export declare function createMemoryCommand(context: CLIContext, cleanupAndExit: (code: number) => Promise<never>, ensureMemoryReady: () => Promise<boolean>): Command;
 //# sourceMappingURL=memory.d.ts.map

package/dist/cli/commands/memory.js

@@ -8,7 +8,7 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { toErrorMessage } from '../../shared/error-utils.js';
-export function createMemoryCommand(context, cleanupAndExit, ensureInitialized) {
+export function createMemoryCommand(context, cleanupAndExit, ensureMemoryReady) {
     const memory = new Command('memory')
         .description('Memory store, retrieve, search, and delete operations')
         .addHelpText('after', `
@@ -47,7 +47,7 @@ Examples:
         .option('--ttl <seconds>', 'Time-to-live in seconds')
         .option('--json', 'Output as JSON')
         .action(async (options) => {
-        if (!await ensureInitialized())
+        if (!await ensureMemoryReady())
             return;
         try {
             const { handleMemoryStore } = await import('../../mcp/handlers/memory-handlers.js');
@@ -91,7 +91,7 @@ Examples:
         .option('--include-metadata', 'Include metadata in response')
         .option('--json', 'Output as JSON')
         .action(async (options) => {
-        if (!await ensureInitialized())
+        if (!await ensureMemoryReady())
             return;
         try {
             const { handleMemoryRetrieve } = await import('../../mcp/handlers/memory-handlers.js');
@@ -141,7 +141,7 @@ Examples:
             console.error(chalk.red('  Either --pattern or --query is required'));
             await cleanupAndExit(1);
         }
-        if (!await ensureInitialized())
+        if (!await ensureMemoryReady())
             return;
         try {
             const { handleMemoryQuery } = await import('../../mcp/handlers/memory-handlers.js');
@@ -186,7 +186,7 @@ Examples:
         .option('--limit <n>', 'Maximum results', '50')
         .option('--json', 'Output as JSON')
         .action(async (options) => {
-        if (!await ensureInitialized())
+        if (!await ensureMemoryReady())
             return;
         try {
             const { handleMemoryQuery } = await import('../../mcp/handlers/memory-handlers.js');
@@ -225,7 +225,7 @@ Examples:
         .option('--namespace <ns>', 'Namespace', 'default')
         .option('--json', 'Output as JSON')
         .action(async (options) => {
-        if (!await ensureInitialized())
+        if (!await ensureMemoryReady())
             return;
         try {
             const { handleMemoryDelete } = await import('../../mcp/handlers/memory-handlers.js');
@@ -264,7 +264,7 @@ Examples:
         .requiredOption('--content <json>', 'JSON content to share')
         .option('--json', 'Output as JSON')
         .action(async (options) => {
-        if (!await ensureInitialized())
+        if (!await ensureMemoryReady())
             return;
         try {
             const { handleMemoryShare } = await import('../../mcp/handlers/memory-handlers.js');
@@ -307,7 +307,7 @@ Examples:
         .description('Show memory usage statistics')
         .option('--json', 'Output as JSON')
         .action(async (options) => {
-        if (!await ensureInitialized())
+        if (!await ensureMemoryReady())
             return;
         try {
             const { handleMemoryUsage } = await import('../../mcp/handlers/memory-handlers.js');

package/dist/cli/commands/platform.js

@@ -18,6 +18,17 @@ import { toErrorMessage } from '../../shared/error-utils.js';
 // Helpers
 // ============================================================================
 const VALID_PLATFORM_IDS = Object.keys(PLATFORM_REGISTRY);
+// Literal import paths let esbuild include every installer in the shipped CLI.
+const PLATFORM_INSTALLERS = {
+    copilot: () => import('../../init/copilot-installer.js'),
+    cursor: () => import('../../init/cursor-installer.js'),
+    cline: () => import('../../init/cline-installer.js'),
+    kilocode: () => import('../../init/kilocode-installer.js'),
+    roocode: () => import('../../init/roocode-installer.js'),
+    codex: () => import('../../init/codex-installer.js'),
+    windsurf: () => import('../../init/windsurf-installer.js'),
+    continuedev: () => import('../../init/continuedev-installer.js'),
+};
 function isValidPlatformId(name) {
     return VALID_PLATFORM_IDS.includes(name);
 }
@@ -205,8 +216,8 @@ export function createPlatformCommand() {
         console.log(chalk.gray('  ─────────────────────────────────'));
         console.log('');
         try {
-            // Dynamic import of the installer
-            const installerModule = await import(`../../init/${name}-installer.js`);
+            // Load the selected installer from a statically declared import.
+            const installerModule = await PLATFORM_INSTALLERS[name]();
             // Resolve the factory function name: create<Name>Installer
             const factoryName = `create${name.charAt(0).toUpperCase()}${name.slice(1).replace(/([a-z])([A-Z])/g, '$1$2')}Installer`;
             // Find the factory function (try common naming patterns)
@@ -267,10 +278,12 @@ export function createPlatformCommand() {
                         console.log(chalk.red(`    ${err}`));
                     }
                 }
+                process.exit(1);
             }
         }
         catch (error) {
             console.log(chalk.red(`  Failed to set up ${platform.name}: ${toErrorMessage(error)}`));
+            process.exit(1);
         }
         console.log('');
     });

package/dist/cli/commands/upgrade.d.ts

@@ -2,9 +2,9 @@
  * `aqe upgrade` — read-only advisory
  *
  * Detects which optional native bindings load on this platform and prints a
- * report with recommendations. Does NOT modify feature flags, env vars, or
- * config files — it only tells the user what they'd gain by installing the
- * missing optional deps.
+ * report with recommendations. It reports the effective runtime flags after
+ * CLI startup applies environment overrides, but does not persist changes to
+ * environment variables or config files.
  *
  * Related: issue #383 item 2.
  */

package/dist/cli/commands/upgrade.js

@@ -2,9 +2,9 @@
  * `aqe upgrade` — read-only advisory
  *
  * Detects which optional native bindings load on this platform and prints a
- * report with recommendations. Does NOT modify feature flags, env vars, or
- * config files — it only tells the user what they'd gain by installing the
- * missing optional deps.
+ * report with recommendations. It reports the effective runtime flags after
+ * CLI startup applies environment overrides, but does not persist changes to
+ * environment variables or config files.
  *
  * Related: issue #383 item 2.
  */

package/dist/cli/handlers/init-handler.d.ts

@@ -70,6 +70,16 @@ export interface InitJsonOutput {
             policy: 'full' | 'compact' | 'none';
             ownedBytes: number;
         };
+        codexComponents?: {
+            hooks: {
+                status: string;
+                error?: string;
+            };
+            skills: {
+                status: string;
+                error?: string;
+            };
+        };
     };
     totalDurationMs: number;
     timestamp: string;

package/dist/cli/handlers/task-handler.js

@@ -5,6 +5,7 @@
  */
 import chalk from 'chalk';
 import { getStatusColor, formatDuration, } from './interfaces.js';
+import { ALL_DOMAINS, isDomainName } from '../../shared/types/index.js';
 import { createTimedSpinner } from '../utils/progress.js';
 import { parseJsonOption } from '../helpers/safe-json.js';
 import { writeOutput, toJSON } from '../utils/ci-output.js';
@@ -32,7 +33,7 @@ export class TaskHandler {
             .option('-d, --domain <domain>', 'Target domain')
             .option('-t, --timeout <ms>', 'Task timeout in ms', '300000')
             .option('--payload <json>', 'Task payload as JSON', '{}')
-            .option('--wait', 'Wait for task completion with progress')
+            .option('--wait', 'Wait for task completion (required: CLI tasks are not persisted)')
             .option('--no-progress', 'Disable progress indicator')
             .action(async (type, options) => {
             await this.executeSubmit(type, options, context);
@@ -67,6 +68,25 @@ export class TaskHandler {
         });
     }
     async executeSubmit(type, options, context) {
+        // #734 D: reject an unknown domain up front instead of accepting work that
+        // no domain will ever run.
+        if (options.domain !== undefined && !isDomainName(options.domain)) {
+            console.error(chalk.red(`\n  Unknown domain: ${options.domain}`));
+            console.error(chalk.gray(`  Valid domains: ${ALL_DOMAINS.join(', ')}\n`));
+            return this.cleanupAndExit(1);
+        }
+        // #734 C: a CLI-submitted task runs inside this process and is not
+        // persisted, so a detached submit would report an ID for work that is
+        // abandoned when the command exits. Refuse it rather than claim success.
+        if (!options.wait) {
+            console.error(chalk.red('\n  Detached task submission is not supported.'));
+            console.error(chalk.gray('  Tasks submitted from the CLI run inside this process and are not persisted;'));
+            console.error(chalk.gray('  the task would be abandoned when the command exits, and `aqe task status`'));
+            console.error(chalk.gray('  from another process could not find it.'));
+            console.error(chalk.gray('  Re-run with --wait to execute the task and report its result, or submit it'));
+            console.error(chalk.gray('  through the MCP server (task_submit), which keeps a long-lived coordinator.\n'));
+            return this.cleanupAndExit(1);
+        }
         if (!await this.ensureInitialized())
             return this.cleanupAndExit(1);
         try {
@@ -294,7 +314,8 @@ Submit Options:
   -d, --domain <domain>       Target domain
   -t, --timeout <ms>          Task timeout in milliseconds (default: 300000)
   --payload <json>            Task payload as JSON
-  --wait                      Wait for task completion with progress
+  --wait                      Wait for task completion (required; CLI-submitted
+                              tasks run in this process and are not persisted)
   --no-progress               Disable progress indicator
 
 List Options:
@@ -303,7 +324,7 @@ List Options:
   -d, --domain <domain>       Filter by domain
 
 Examples:
-  aqe task submit generate-tests --domain test-generation
+  aqe task submit generate-tests --domain test-generation --wait
   aqe task submit analyze-coverage --wait --timeout 60000
   aqe task list --status running
   aqe task status task-123

package/dist/cli/helpers/standalone-memory.d.ts

@@ -0,0 +1,12 @@
+import type { CLIContext } from '../handlers/interfaces.js';
+/**
+ * Build the readiness check for `aqe memory` subcommands.
+ *
+ * Memory operations only need the project memory backend, so this opens
+ * .agentic-qe/memory.db directly instead of booting the full v3 system
+ * (kernel, Queen Coordinator, every domain coordinator, SONA engines,
+ * DreamScheduler). If a fleet is already running in this process, its kernel
+ * memory is used as before.
+ */
+export declare function createEnsureMemoryBackend(context: CLIContext): () => Promise<boolean>;
+//# sourceMappingURL=standalone-memory.d.ts.map

package/dist/cli/helpers/standalone-memory.js

@@ -0,0 +1,46 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import chalk from 'chalk';
+import { toErrorMessage } from '../../shared/error-utils.js';
+/**
+ * Build the readiness check for `aqe memory` subcommands.
+ *
+ * Memory operations only need the project memory backend, so this opens
+ * .agentic-qe/memory.db directly instead of booting the full v3 system
+ * (kernel, Queen Coordinator, every domain coordinator, SONA engines,
+ * DreamScheduler). If a fleet is already running in this process, its kernel
+ * memory is used as before.
+ */
+export function createEnsureMemoryBackend(context) {
+    let ready = null;
+    const open = async () => {
+        try {
+            const [{ findProjectRoot }, { createKernelMemoryBackend }, { setStandaloneMemoryBackend }] = await Promise.all([
+                import('../../kernel/project-root.js'),
+                import('../../kernel/hybrid-backend.js'),
+                import('../../mcp/handlers/memory-handlers.js'),
+            ]);
+            // Same data directory the kernel resolves when auto-initializing.
+            const dataDir = path.join(findProjectRoot(), '.agentic-qe');
+            fs.mkdirSync(dataDir, { recursive: true });
+            const backend = createKernelMemoryBackend(dataDir);
+            await backend.initialize();
+            setStandaloneMemoryBackend(backend);
+            return true;
+        }
+        catch (error) {
+            console.error(chalk.red(`  Failed to open memory store: ${toErrorMessage(error)}`));
+            // Callers `return` on false; main() then exits with this code, matching
+            // ensureInitialized()'s failure path (#758).
+            process.exitCode = 1;
+            return false;
+        }
+    };
+    return () => {
+        if (context.initialized)
+            return Promise.resolve(true);
+        ready ??= open();
+        return ready;
+    };
+}
+//# sourceMappingURL=standalone-memory.js.map